The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadatafteSamplesUser field to the /transfer URI.
Publication date: Fri, 17 Aug 2012 15:31:00 +0000